Support Center

How to Remove Adware

Removing adware is relatively simple.

The hard part is looking for the specific key files to delete and keeping up to date with the latest adware information and knowing which key files to look for and delete.

This guide will help walk you through removing the most common adware for free. 🙂

If you want a useful Mac app that will do this for you with the click of 1-button, then it’s worth checking out Adware Cleaner on the Mac App Store. These instructions may seem daunting, so some people may want to take the easier road using the app.

1. Check Your Browser Extensions

It is very common for Adware to hide in your browser extensions and/or add-ons. Look at your extensions you have installed in your browser:

  • Safari – From the Safari menu, go to Preferences -> Extensions, near the right side of the row of icons along the top of the window.
  • Chrome – From the Chrome menu, go to Preferences -> Extensions item in the list on the left side of the window.
  • Firefox – Go to Add-ons from the Tools menu, then look at both the Extensions and Plugins lists in the window that opens.

There are lots of good browser extensions out there, but be careful which ones you decide to install. If you see extensions that you don’t remember installing, it is most likely adware. Below is a list of some common Adware that you might see installed.

  • Omnibar, GoldenBoy, Texiday, Listchack, InKeepr, Nariabox, Celipsow
  • savekeep, saVe keeep, suave keepo, or anything similar
    • Delete all of the following browser extensions that you find: savekeep, saVe keeep and suave keepo.
  • jollywallet cash back
    • Delete the “jollywalet cash back” browser extension.
  • Vidx, Viddxx, Vidox, Viidax, ViiDDx, MacVX (and variants like MacVaX), MacCaptain, MacPriceCut, SaveOnMac, Mac Global Deals or MacDeals, MacSter, MacXcoupon, Shop Brain (or variants like SShoP Braaiin), MacMin (and variants like MacMMin, MaucMino, etc)
    • Delete any browser extensions with the following names:

      Vidx (or variants such as ViddX, Vidox, Viidax and ViiDDx)
      MacVx (or variants such as MacVax or MacVox)
      MacCaptain
      MacPriceCut
      SaveOnMac
      Mac Global Deals
      MacDeals
      MacSter
      MacXcoupon
      Shop Brain (or variants such as SShoP Braaiin)
      MacMin (or variants such as MacMMin or MaucMino)
      MacCost

      Move the following items to the trash.

      /Applications/Vidx.app
      /Applications/MacMin.app
      /Library/Application Support/VidToMP3
      /Library/Application Support/fa4e8.94b.550d413f
      ~/Library/Application Support/osxDownloader

  • MacMin (and variants like MacMMin, MaucMino, etc) – see Vidx removal
  • Awesome Screenshot
    • Remove this extension
  • Shopy Mate, PalMall, FlashMall, Cinema-Plus Pro (and variants like Cinema + HD, Cinema + Plus + or Cinema Ploos)
    • Delete all of the following browser extensions that you find: Shopy Mate, FlashMall, Cinema-Plus Pro(and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos).

      Move the following items to the trash.

      /Applications/WebTools.app
      /Applications/WebShopper.app
      ~/Applications/WebTools.app
      ~/Applications/WebShopper.app
      /Library/cinemapro1-2/
      ~/Library/cinemapro1-2/
      ~/Library/WebTools/
      ~/Library/Application Support/webHelperApp/
      ~/Library/Application Support/WebShopper/
      ~/Library/LaunchAgents/WebServerSocketApp
      ~/Library/LaunchAgents/UpdateDownloder
      ~/Library/LaunchAgents/com.webhelper.plist
      ~/Library/LaunchAgents/com.webtools.update.agent.plist
      ~/Library/LaunchAgents/com.webtools.uninstaller.plist

  • Search App by Ask
    • Delete any extension called something like Search App by Ask.

      Move the following items to the trash.

      ~/Library/Application Support/Sponsors.framework

  • MacShop, MacSmart, News Ticker Remover, Shopper Helper Pro, Photo Zoom, Best YouTube Downloader, ArcadeYum, Extended protection, Video download helper, FlashFree, RecipeHub, iLivid, CustomSearchForSafari, Media Player, MusixLib, GoMovix, MovixHub, AdBlock Super, Webpage Screenshot, NewTabTV, WalletBee
    • Remove these extensions
  • PremierOpinion
  • Opti-Page, Toppy
    • Delete all of the following browser extensions that you find: Opti-Page, Toppy.

      Move the following items to the trash.

      ~/Library/Application Support/Google/Chrome/Default/chromex
      ~/Library/Application Support/Google/Chrome/Default/chromexdm
      ~/Library/Application Support/mediahm
      ~/Library/LaunchDaemons/com.mediahm.operator.update.plist

  • Codec-M
    • Delete the Codec-M browser extension.
      Move the following items to the trash.

      ~/Library/Application Support/Codec-M
      ~/Library/LaunchAgents/com.codecm.uploader.plist
      /Applications/Codec-M.app

  • Yontoo and/or Torrenthandler
    • Delete the Yontoo and Torrenthandler browser extensions.
  • Anything claiming to be Adobe Flash Player
    • Delete any Safari extensions claiming to be Adobe Flash Player. The real Flash Player does not use a browser extension.
  • ChatZum
    • Delete the ChatZum browser extension.
      Move the following items to the trash.

      /Applications/ChatZumUninstaller.pkg
      /Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
      /Library/Internet Plug-Ins/uid.plist
      /Library/Internet Plug-Ins/zako.plugin

  • Conduit, MyBrand, Trovi, Search Protect, SP, or anything ending with Community Toolbar
    • Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
      Move the following items to the trash.

      /Library/InputManagers/CTLoader/
      /Library/LaunchAgents/com.conduit.loader.agent.plist
      /Library/LaunchDaemons/com.perion.searchprotectd.plist
      /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
      /Library/Application Support/Conduit/
      /Applications/SearchProtect.app
      /Applications/SearchProtect/
      ~/Library/Application Support/Conduit/
      ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
      ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
      ~/Conduit/
      ~/Trovi/

  • Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant
    • Delete all of the following browser extensions that you find: Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant.

      Move the following items to the trash.

      ~/Library/LaunchAgents/com.spigot.SearchProtection.plist
      ~/Library/LaunchAgents/com.spigot.ApplicationManager.plist
      ~/Library/Application Support/Spigot/

  • Set Search Settings, searchtab, any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch, and any extension with a person’s name, such as JeffKekkoor BrianDeer
    • Delete all of the following browser extensions that you find: Set Search Settings, searchme, searchtab, and any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch. In addition, extensions whose names are a person’s name, such as JeffKekko or BrianDeer, should be disabled.
  • GoPhoto.it
    • Delete the GoPhoto.it and jollywallet cash back browser extensions.

2. Check Your Libraries
Adware can install “LaunchAgents” to keep running in the background 24/7. Look in two different LaunchAgents folders to see a file matching the description. If you do, it’s Adware.

~/Library/LaunchAgents

  • com.codecm.uploader.plist
    • Delete the Codec-M browser extension.
      Move the following items to the trash.

      ~/Library/Application Support/Codec-M
      ~/Library/LaunchAgents/com.codecm.uploader.plist
      /Applications/Codec-M.app

  • anything with the word “genieo” in it
  • a set of three files, each with names starting with the same text and ending in “.download.plist”, “.ltvbit.plist” and “.update.plist”
  • Safari Security, files ending in “_enabler.plist”, “_enabler.sh”, “_updater.plist”, “_updater.sh”. WebSocketServerApp, com.webhelper.plist, com.webtools.update.agent.plist, anything starting with com.crossrider.wss. UpdateDownloader, anything similar to com.extensions.updater69337.agent.plist or com.extensions.updater69337.ver
    • Delete all of the following browser extensions that you find: Shopy Mate, FlashMall, Cinema-Plus Pro(and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos).

      Move the following items to the trash.

      /Applications/WebTools.app
      /Applications/WebShopper.app
      ~/Applications/WebTools.app
      ~/Applications/WebShopper.app
      /Library/cinemapro1-2/
      ~/Library/cinemapro1-2/
      ~/Library/WebTools/
      ~/Library/Application Support/webHelperApp/
      ~/Library/Application Support/WebShopper/
      ~/Library/LaunchAgents/WebServerSocketApp
      ~/Library/LaunchAgents/UpdateDownloder
      ~/Library/LaunchAgents/com.webhelper.plist
      ~/Library/LaunchAgents/com.webtools.update.agent.plist
      ~/Library/LaunchAgents/com.webtools.uninstaller.plist

/Library/LaunchAgents

  • anything with the word “genieo” or “texiday” in it, or with a name starting with “com.installer.completer”
  • com.conduit.loader.agent.plist
    • Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
      Move the following items to the trash.

      /Library/InputManagers/CTLoader/
      /Library/LaunchAgents/com.conduit.loader.agent.plist
      /Library/LaunchDaemons/com.perion.searchprotectd.plist
      /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
      /Library/Application Support/Conduit/
      /Applications/SearchProtect.app
      /Applications/SearchProtect/
      ~/Library/Application Support/Conduit/
      ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
      ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
      ~/Conduit/
      ~/Trovi/

  • com.vsearch.agent.plist (There are a number of variants that substitute other random words for “vsearch” in this file name)
    • Move the following items to the trash.

      /Library/Application Support/VSearch
      /Library/LaunchAgents/com.vsearch.agent.plist
      /Library/LaunchDaemons/com.vsearch.daemon.plist
      /Library/LaunchDaemons/com.vsearch.helper.plist
      /Library/LaunchDaemons/Jack.plist
      /Library/PrivilegedHelperTools/Jack
      /System/Library/Frameworks/VSearch.framework
      /System/Library/Frameworks/v.framework

      You may also find files with the following names, where “xxx” can be any word:

      /Library/LaunchAgents/com.xxx.agent.plist
      /Library/LaunchDaemons/com.xxx.daemon.plist
      /Library/LaunchDaemons/com.xxx.helper.plist

/Library/LaunchDaemons

  • Jack.plist, com.vsearch.daemon.plist or com.vsearch.helper.plist
    • Move the following items to the trash.

      /Library/Application Support/VSearch
      /Library/LaunchAgents/com.vsearch.agent.plist
      /Library/LaunchDaemons/com.vsearch.daemon.plist
      /Library/LaunchDaemons/com.vsearch.helper.plist
      /Library/LaunchDaemons/Jack.plist
      /Library/PrivilegedHelperTools/Jack
      /System/Library/Frameworks/VSearch.framework
      /System/Library/Frameworks/v.framework

      You may also find files with the following names, where “xxx” can be any word:

      /Library/LaunchAgents/com.xxx.agent.plist
      /Library/LaunchDaemons/com.xxx.daemon.plist
      /Library/LaunchDaemons/com.xxx.helper.plist

  • com.perion.searchprotectd.plist
    • Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
      Move the following items to the trash.

      /Library/InputManagers/CTLoader/
      /Library/LaunchAgents/com.conduit.loader.agent.plist
      /Library/LaunchDaemons/com.perion.searchprotectd.plist
      /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
      /Library/Application Support/Conduit/
      /Applications/SearchProtect.app
      /Applications/SearchProtect/
      ~/Library/Application Support/Conduit/
      ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
      ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
      ~/Conduit/
      ~/Trovi/

  • PremierOpinion.plist

/Library/Internet Plug-Ins

  • zako.plugin
    • Delete the ChatZum browser extension.
      Move the following items to the trash.

      /Applications/ChatZumUninstaller.pkg
      /Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
      /Library/Internet Plug-Ins/uid.plist
      /Library/Internet Plug-Ins/zako.plugin

Still No Adware Found?

Check your symptoms to make sure you have adware or spyware. You might just be experiencing popup ads that can be blocked using the useful adblock browser extension – https://getadblock.com

Hopefully this isn’t the case, but you could possibly have Malware. BitMedic is a great AntiVirus app available on the Mac App Store for removing Malware.

Don’t forget to see our guide on How to PREVENT more adware.

If you have any questions, feel free to email us at support@pocketbitsllc.com.